Threats tagged 'ghsa-6xmv-cjr5-w3q8'

fastapi-code-generator versions prior to 0.8.1 contain a critical import-time remote code execution vulnerability. This occurs because the tool emits response status-code keys into the FastAPI route decorator's responses dictionary as unescaped single-quoted string literals. An attacker-controlled status-code key containing a single quote can break out of the string context and inject arbitrary Python expressions that execute during module import, before any request is made. This affects applications generating FastAPI code from attacker-influenced OpenAPI specs with multiple responses. The vulnerability is fixed in version 0.8.1 by properly escaping status-code keys and validating their format.